What’s New This Week in AI Engineering: Agents Get Runtime Receipts

The week of September 28 through October 4 was not only a model-release week. It was a runtime-accountability week. OpenAI moved browser computer use into the Agents API. Anthropic launched Claude Sonnet 5.5 and immediately gave teams a retirement window for Sonnet 4.5. LangChain releases focused on compatibility, fallback, and replay edges. OpenAI’s Agents SDK added small but telling controls around MCP listing and Docker sandbox removal. vLLM’s release cadence continued to show that inference teams are optimizing around model-specific serving constraints, not a single generic LLM server.

For production AI teams, the theme is receipts. Browser actions need approval receipts. Model migrations need compatibility receipts. Tool replay needs argument receipts. Inference upgrades need workload receipts. Agent platforms are becoming safer not because prompts are better, but because the runtime is exposing more of the state that used to be hidden.

Scope note: this report favors official documentation, release notes, and project release feeds. MCP did not publish a new specification version in the target week. I cover it as a compatibility baseline because several adjacent releases touched MCP listing, tool visibility, or tool replay behavior. The vLLM item is labeled as publish-day context because the release landed on October 5, just outside the research window but before this post went live.

Executive read

Area	What changed	Why production teams should care	Action this week
OpenAI Agents API	Hosted computer use was added to the Agents API	Browser automation now has to be governed like a privileged tool runtime	Design approval, identity, and sandbox logs before enabling autonomous browsing
OpenAI Agents SDK	MCP listing page limits and Docker removal protection shipped in v0.23.0	Runtime guardrails are becoming part of the SDK surface	Put limits around tool discovery and make destructive sandbox cleanup opt-in
Anthropic Claude	Sonnet 5.5 launched, and Sonnet 4.5 received a November 30 retirement date	Model upgrades now have a short, explicit migration clock	Run compatibility canaries and retire model IDs from config, prompts, evals, and traces
LangChain	Releases patched Sonnet 5.5 compatibility, fallback cache handling, and invalid tool-call replay	Framework upgrades increasingly affect runtime state, not just developer ergonomics	Add regression tests around fallback models, structured output, and replayed tool calls
vLLM and inference	Serving releases are optimizing model-specific kernels, KV cache, and MoE paths	Throughput changes can alter capacity assumptions and failure modes	Canary with your exact prompt lengths, batch shapes, and rollback budget

Pattern to watch: the most useful updates this week all move hidden runtime state into something an engineer can bound, log, replay, or retire. That is why this report emphasizes receipts more than raw feature announcements.

1. OpenAI computer use moves browser automation into the agent runtime

OpenAI’s platform changelog for September 29 says computer use was added to the Agents API. The important detail is not simply that an agent can operate a browser. The changelog describes OpenAI-hosted browser execution, website access approvals, and sign-in handled by the application.

That combination changes the production question. Browser automation is no longer an experimental script on an engineer’s laptop. It becomes a privileged tool class with identity, approval, session state, and side effects.

flowchart LR
    User[User request] --> Policy[Approval policy]
    Policy --> Agent[Agent session]
    Agent --> Browser[Hosted browser]
    Browser --> Site[External website]
    Browser --> Log[Action log]
    Log --> Audit[Audit and replay]

The common mistake will be treating hosted computer use as a more convenient browser driver. It is better to treat it like production infrastructure:

• Define which websites and workflows are in scope.
• Record who approved a website access request and why.
• Keep browser session identifiers in trace metadata.
• Separate read-only browsing from form submission, account changes, purchasing, or data export.
• Write policy tests for dangerous UI states, not just tool schemas.

The engineering tradeoff is control versus capability. A browser can use services that do not expose APIs, but it also inherits the ambiguity of UI state. Production teams should start with workflows where the page state can be verified independently: read-only research, QA checks, controlled admin dashboards, or internal review queues.

2. Small SDK controls are signals of agent-runtime maturity

The OpenAI Agents Python SDK v0.23.0 release, published October 2, included configurable MCP listing page limits and opt-in Docker removal protection. Those sound minor compared with a model launch, but they are exactly the kind of controls production agent systems need.

MCP listing limits matter because tool discovery is part of the prompt and policy surface. If a server exposes thousands of tools, resources, or prompts, the agent runtime needs pagination, bounds, and caching decisions. Otherwise the system can fail before the model makes a bad decision: tool listings become too large, too slow, or too unstable to reason about.

Docker removal protection matters because sandboxes are not disposable if they contain evidence. During development, deleting a container is cleanup. During production incident analysis, deleting a sandbox can mean deleting the only reproduction artifact.

Best practice:

1. Cap tool discovery and log the visible tool set used for each run.
2. Persist the tool-listing version or page cursor in the run record.
3. Make sandbox deletion an explicit lifecycle transition.
4. Preserve artifacts before cleanup when a run fails after a side effect.
5. Treat SDK upgrades as runtime changes, not dependency housekeeping.

3. Claude Sonnet 5.5 turns model choice into a migration program

Anthropic’s September 28 release notes launched Claude Sonnet 5.5 across the Claude API and major cloud providers. Two days later, Anthropic announced deprecation of Claude Sonnet 4.5 on the Claude API, with retirement scheduled for November 30, 2026, and recommended migration to Sonnet 5.5.

That is a useful forcing function. Model upgrades are often handled as config edits: change the model name, run a smoke test, and ship. That is not enough for production agents. A model change can alter tool-call phrasing, refusal behavior, latency, output length, JSON validity, code style, and hidden assumptions in evals.

A safer migration plan looks like this:

sequenceDiagram
    participant Config
    participant Eval as Regression suite
    participant Canary
    participant Prod
    Config->>Eval: add Sonnet 5.5 candidate
    Eval-->>Config: pass/fail by workflow
    Config->>Canary: route low-risk traffic
    Canary-->>Config: compare traces and errors
    Config->>Prod: promote with rollback model id

The mistake to avoid is validating only answer quality. Production compatibility also includes tool usage, schemas, rate limits, context windows, cost, and the application’s own post-processing. If a workflow depends on a model emitting a narrow JSON structure or choosing a tool only after a human approval boundary, migration tests must cover that behavior explicitly.

The practical takeaway: keep a model retirement ledger. Every model ID should have an owner, affected workflows, eval status, canary status, rollback policy, and last-seen production trace.

4. LangChain’s releases show where agent frameworks break in production

LangChain’s September 28 through September 30 releases are a useful map of production fault lines. The release notes include Sonnet 5.5 compatibility fixes, fallback cache setting fixes, recognition of GPT-6 structured output without profiles, Azure workload identity discovery, and serialization of invalid tool calls as tool use on replay.

Those are not cosmetic improvements. They touch the edges where frameworks often fail under real traffic:

• fallback models may inherit cache settings that were safe for one provider but wrong for another;
• structured output may break when a new model profile is missing or stale;
• invalid tool calls may disappear or mutate during replay;
• cloud identity discovery may work locally but fail inside production workloads.

The production lesson is to test seams, not just happy paths. For agent frameworks, the seam is usually a state transition:

flowchart TD
    A[Model response] --> B{Structured output?}
    B -->|valid| C[Application handler]
    B -->|invalid tool call| D[Replay and repair path]
    C --> E[Trace store]
    D --> E
    E --> F[Regression eval]

A good weekly maintenance task is to replay a small set of real traces against the new framework version before upgrading. Include traces with invalid tool calls, provider fallback, human edits, long context, and MCP object arguments. If the replay output cannot explain which arguments changed, the framework is not giving you enough receipts.

5. vLLM reminds us that inference upgrades are workload migrations

vLLM’s v0.31.0 release landed on October 5, just outside the prior-week window but directly relevant on publish day. It highlights hundreds of commits and model-serving optimizations around DeepSeek-V4.1-Flash, compressed KV cache paths, fused kernels, MoE boundaries, and platform-specific performance work. v0.30.0, published September 22, had already shown the same pattern: model-specific serving changes are now a normal part of operating an inference layer.

The key point for platform engineers is that inference upgrades are not generic package bumps. They are workload migrations. A faster kernel can change memory pressure. A new KV-cache path can change concurrency. A model-specific optimization can improve one workload while leaving another unchanged. MoE routing and speculative paths can expose edge cases in long outputs, tool-call delimiters, or batch scheduling.

Runtime surface	What to verify	Why it matters
KV cache sizing	Real prompt lengths, retained context, and max batch mix	Capacity planning fails when synthetic prompts are shorter than production prompts
Tool-call text	Delimiters, JSON fences, and stop sequences	Serving changes can surface as parsing bugs, not model-quality bugs
Rollback	Previous image, previous model, previous scheduler settings	Fast inference changes need fast rollback
Metrics	Tokens/sec, queue wait, OOMs, retries, timeouts	Throughput without tail-latency data is not an SLO

The correct question is not “Is vLLM faster?” It is “Does this serving build preserve my application’s contracts at the traffic shape I actually run?”

6. MCP is the compatibility baseline, not just a tool-calling brand

The MCP specification page currently reports version 2026-07-28. No newer spec version appeared in the prior-week source probe. That absence is itself useful: MCP is stable enough that ecosystem releases are now about operational compatibility.

This week’s adjacent signals were MCP listing controls in the OpenAI Agents SDK and Anthropic release-note language around MCP connector tool listings. In production, tool discovery is not a static list in a README. It is live protocol state that can affect prompt size, authorization, cache behavior, and replay.

Treat MCP integration as a contract with four separate receipts:

1. which server was connected;
2. which tools were listed;
3. which tool schema version was visible;
4. which validated arguments were sent.

If a team cannot reconstruct those four facts for a failed agent run, it will struggle to explain whether the failure came from the model, the client, the MCP server, authorization, or a stale listing cache.

How Hermes uses this: Forge posts as runtime receipts

This weekly article is a small Hermes case study. The scheduled workflow does not just ask a model to write a post and hope for the best. Forge owns canonical markdown. WordPress is a publishing target. The run writes brief.yaml, research.md, article.md, target metadata, and a JSONL run log. The article is reviewed three times before publishing. The visible hero chart is a real fetched image URL, not a prompt. The final verifier checks category, source count, image presence, run events, WordPress state, and the public page.

That maps directly to the agent-runtime lessons above:

• Browser and website actions need approval and audit receipts.
• Model migrations need eval and canary receipts.
• MCP tools need listing and argument receipts.
• Sandboxes need lifecycle receipts.
• Published content needs source, visual, and target-state receipts.

The broader pattern is simple: move critical state out of the chat transcript and into durable artifacts that can be inspected after the run.

Operator checklist

Use this week to tighten runtime accountability. Start with the item that touches the broadest blast radius in your stack, then use the rest as a release-readiness checklist:

1. Add an approval record to every browser-capable agent workflow.
2. Build a model retirement ledger for Sonnet 4.5 and any other scheduled deprecations.
3. Replay invalid tool-call traces before upgrading agent frameworks.
4. Cap MCP discovery and store the listed tool set per run.
5. Canary inference upgrades with real prompt lengths and tool-call outputs.
6. Preserve sandbox artifacts before destructive cleanup.
7. Make every production agent side effect answer three questions: who authorized it, what exact arguments ran, and what artifact proves it?

Bottom line

This week’s strongest signal is that AI engineering is becoming runtime engineering. The interesting releases were not only new models. They were hosted browser execution, model retirement windows, tool-listing limits, replay fixes, cloud identity support, and serving-stack optimizations.

That is what production teams should want. Prompts are still important, but prompts without receipts are hard to operate. The systems that win will be the ones that make every agent action, model migration, tool call, sandbox lifecycle, and publish step inspectable after the fact. This week’s practical mandate is therefore straightforward: before adding more autonomy, make sure the runtime can prove what happened.

References

1. OpenAI Platform changelog
2. OpenAI Agents Python releases
3. Anthropic Claude Platform release notes
4. LangChain releases
5. LangGraph releases
6. Model Context Protocol specification
7. vLLM releases
8. Sieon Labs weekly AI engineering series inventory